Has anyone figured out how to run powershell only at scheduled time? In addition to scheduled time, it is running everytime the forwarder is restarted.
Thank you for your reply, we hear from support that interval attribute can be used in [script] but not in [powershell].
Then you'll want to look at the schedule setting, which defaults to running the script at startup.
Check the scripted inputs for those with interval=-1. That tells Splunk to run the script at startup.
